[Snort-sigs] Sourcefire VRT Certified Snort Rules Update 2010-09-27

waldo kitty wkitty42 at ...3507...
Tue Sep 28 14:42:19 EDT 2010


On 9/28/2010 13:29, Eoin Miller wrote:
>    On 9/28/2010 5:25 PM, waldo kitty wrote:
>> On 9/28/2010 11:03, infosec posts wrote:
>>> I have to ask, because I must be missing something here.
>>>
>>> SID:17494 - web-client.rules -
>> what's the GID? i suspect it is 3??
>>
>> FWIW: i see that the GID is becoming more and more important when talking about
>> rules...
>>
> It's (the GID) going to be 1 because that ruleset is not for a preprocessor.

GID:3 is preprocessor? i thought they were the (pre)compiled SO rules ;)





More information about the Snort-sigs mailing list